This privacy notice explains how car-box.info collects, processes, and protects your personal data when you interact with this website, ensuring compliance with global data protection regulations, including the General Data Protection Regulation (GDPR) for the European Economic Area (EEA), the UK GDPR, and applicable US state privacy laws (such as the CCPA/CPRA).
This website is not intended for children under 16, and we do not knowingly collect data relating to children.
1. The Data We Collect About You
Personal data means any information capable of identifying an individual. It does not include anonymized data. We collect, use, store, and transfer different kinds of personal data, categorized as follows:
- Contact Data: Email address (if provided voluntarily).
- Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, platform, and device information.
- Usage Data: Information about how you use our website, including full Uniform Resource Locators (URL) clickstreams (date and time), pages viewed, search terms, page response times, download errors, visit lengths, and interaction data (scrolling, clicks, mouse-overs).
- Communications Data: Emails and notes of conversations if you contact us for support or inquiries.
We also collect and use Aggregated Data (e.g., statistical or demographic data). While derived from your personal data, Aggregated Data is not considered personal data in law as it does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data, it will be treated in accordance with this privacy notice.
2. How Your Personal Data is Collected
- Direct interactions: You may provide Contact and Communications Data by corresponding with us via email, submitting forms, or providing feedback.
- Automated technologies: As you interact with our website, we automatically collect Technical and Usage Data about your equipment and browsing patterns using cookies, server logs, and similar technologies.
3. How We Use Your Personal Data and Legal Bases
We will only use your personal data when permitted by law. Below is a description of the ways we plan to use your personal data and the legal bases we rely on to do so.
- To administer and protect our business and website (troubleshooting, data analysis, testing, system maintenance, security)
Data Categories: Technical, Usage
Lawful Basis for Processing: Legitimate interest (provision of secure IT services, network security) and Legal obligation. - To deliver relevant website content and advertisements and measure advertising effectiveness
Data Categories: Technical, Usage
Lawful Basis for Processing: Legitimate interest (studying how users use our services to develop them and inform our marketing strategy) / Consent (where required by local law). - To use data analytics to improve our website, services, user relationships, and experiences
Data Categories: Technical, Usage
Lawful Basis for Processing: Legitimate interest (defining types of customers, keeping our website updated and relevant). - To respond to your inquiries and manage communications
Data Categories: Contact, Communications
Lawful Basis for Processing: Legitimate interest (maintaining customer relations) or Performance of a contract.
4. Disclosures and Data Sharing
We do not sell your personal data for monetary compensation. However, we may share your data with specific third parties for the purposes outlined above:
- Service Providers: Third-party vendors acting as processors who provide IT, system administration, and analytics services (e.g., Google Analytics).
- Advertising Partners: Third-party networks (e.g., Google Ads) that require data to serve targeted advertisements.
- Legal Authorities: When required to comply with a legal or regulatory obligation.
We require all third parties to respect the security of your personal data and treat it in accordance with the law. Service providers are only permitted to process your data for specified purposes and in accordance with our instructions.
5. International Data Transfers
As we operate globally, your personal data may be transferred outside of the EEA or the UK to third-party service providers (such as those based in the United States). Whenever we transfer your personal data out of the EEA or UK, we ensure a similar degree of protection is afforded to it by utilizing at least one of the following safeguards:
- Transferring data to countries deemed to provide an adequate level of protection by the European Commission or the UK government.
- Using specific contracts approved by the European Commission (Standard Contractual Clauses) and the UK Information Commissioner's Office (International Data Transfer Agreement/Addendum).
- Transferring data to US-based entities certified under the EU-US Data Privacy Framework (and the UK Extension), which replaces the invalidated Privacy Shield framework.
6. Data Security and Retention
We maintain appropriate organizational and technical security measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorized way. Access to your personal data is limited to agents and contractors who have a strict business need to know, subject to confidentiality duties.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use, the purposes of processing, and applicable legal requirements.
7. Global Privacy Rights (EEA, UK, and General Users)
Under the GDPR and UK GDPR, users located in the EEA and the UK have specific rights regarding their personal data. To exercise these rights, contact us at admin@car-box.info.
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of incomplete or inaccurate data.
- Right to Erasure (Right to be Forgotten): Ask us to delete personal data where there is no good reason for us to continue processing it.
- Right to Object: Object to processing relying on legitimate interests or for direct marketing purposes.
- Right to Restriction: Request the suspension of processing in specific scenarios (e.g., to establish data accuracy).
- Right to Data Portability: Request the transfer of automated personal data to you or a third party in a structured, machine-readable format.
- Right to Withdraw Consent: Withdraw consent at any time where we rely on it to process your personal data.
Regulatory Complaints
You have the right to lodge a complaint with your local data protection authority.
- EU Residents: The National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania or your national DPA.
- UK Residents: The Information Commissioner's Office (ICO).
We respectfully request the opportunity to address your concerns before you approach a supervisory authority.
8. United States Privacy Rights (CCPA/CPRA)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and similar state laws (e.g., VCDPA, CPA) grant US residents specific rights regarding their personal information.
Your Rights
- Right to Know/Access: Know the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom it is shared.
- Right to Delete: Request the deletion of your personal information, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out of Sale or Sharing: Direct us not to "sell" or "share" your personal information for cross-context behavioral advertising.
- Right to Non-Discrimination: You will not receive discriminatory treatment for exercising these rights.
- Shine the Light: California residents may request details about how we share personal information with third parties for direct marketing purposes (one request per year via admin@car-box.info).
CCPA Disclosures (Past 12 Months)
While we do not exchange your data for money, the CCPA defines "sale" and "sharing" very broadly. Because we use third-party tracking cookies (Google Analytics, Google Ads) to optimize our site and provide relevant advertising, we have "sold" or "shared" the following categories of information for a business purpose in the preceding 12 months:
- Identifiers (IP addresses, cookie IDs)
- Internet or electronic network activity information (browsing history on our site)
- Geolocation data (general location based on IP)
- Inferences drawn from the above.
To exercise your US privacy rights, or to designate an authorized agent to submit requests on your behalf, contact us at admin@car-box.info. We may require verification of your identity and the agent's authorization.
9. Cookies, Tracking, and Opt-Outs
We use cookies to ensure the basic functioning of the website and to analyze traffic and ad performance.
- Google Analytics: We use Google Analytics to understand how visitors engage with our site. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
- Google Ads: We use Google Ads to deliver personalized advertising. You can manage your ad preferences and opt out of personalized ads by visiting Google's Ad Settings.
- Browser Settings: You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. Note that disabling cookies may cause certain parts of this website to function improperly.